Shibboleth session vs Application session

[Cantor, Scott]

On 12/16/14, 7:01 PM, "Eric Goodman" <Eric.Goodman at ucop.edu> wrote:

> 
>> If you're using Username/Password authentication the page:
>> 
>> 	https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUser Pass
>
>Scott, at the bottom of this page is a note about the IdP Session 
>Lifetime saying:
>
>" Admittedly, this is a totally confusing and poorly represented setting. 
>It will be changed in a future release."
>
>Are there settings changes planned (or already implemented) in these 
>areas in V3?

You mean [1] I think. That UserPass page is a horror show.

There's still no IdP session lifetime (because it doesn't serve any 
purpose), but the timeout is in the idp.properties file:

# Inactivity timeout
#idp.session.timeout = PT60M

I assume the comment was because aside from being buried in a DONOTCHANGE 
file and not labeled other than as an argument to some bean, it's being 
called a "lifetime". So yeah, that's fixed.

Despite being completely rewritten, the model is the same here. The 
session is a container for individual AuthenticationResult and SPSession 
objects, each of which are managed independently of the session. I guess a 
change is that AuthenticationResults have both a lifetime and a timeout 
now, not just a lifetime.

-- Scott


[1] https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUserAuthn